java.lang.NullPointerException as soon as a new vocabulary is created

The following bug an reprocedure steps are arleady described in the liferay forum threat
http://www.liferay.com/community/forums/-/message_boards/message/14556543

Summary:
As soon as a vocabulary is added using the LR control panel the creation of an organization/location leads to a java.lang.NullPointerException in ender_portlet_jsp:154

Behavior in the UI/Control panel:
After filling in the basic parameters for a location, in the control panel I get:

Users and Organizations is temporarily unavailable.

Stacktrace:
The stack trace shows a NullPointerException:
11:14:21,280 INFO [stdout] (http-sb-saildvl-01-172.31.131.129-8080-4) 11:14:21,273 ERROR [render_portlet_jsp:154] java.lang.NullPointerException
11:14:21,280 INFO [stdout] (http-sb-saildvl-01-172.31.131.129-8080-4) at com.liferay.portlet.asset.util.BaseAssetEntryValidator.validate(BaseAssetEntryValidator.java:105)
11:14:21,280 INFO [stdout] (http-sb-saildvl-01-172.31.131.129-8080-4) at com.liferay.portlet.asset.util.BaseAssetEntryValidator.validate(BaseAssetEntryValidator.java:74)
11:14:21,280 INFO [stdout] (http-sb-saildvl-01-172.31.131.129-8080-4) at com.liferay.portlet.asset.service.impl.AssetEntryLocalServiceImpl.validate(AssetEntryLocalServiceImpl.java:815)
11:14:21,281 INFO [stdout] (http-sb-saildvl-01-172.31.131.129-8080-4) at com.liferay.portlet.asset.service.impl.AssetEntryLocalServiceImpl.updateEntry(AssetEntryLocalServiceImpl.java:572)
11:14:21,281 INFO [stdout] (http-sb-saildvl-01-172.31.131.129-8080-4) at com.liferay.portal.spring.aop.ServiceBeanMethodInvocation.proceed(ServiceBeanMethodInvocation.java:112)
11:14:21,281 INFO [stdout] (http-sb-saildvl-01-172.31.131.129-8080-4) at com.liferay.portal.spring.transaction.TransactionInterceptor.invoke(TransactionInterceptor.java:71)
11:14:21,281 INFO [stdout] (http-sb-saildvl-01-172.31.131.129-8080-4) at com.liferay.portal.spring.aop.ServiceBeanMethodInvocation.proceed(ServiceBeanMethodInvocation.java:108)
11:14:21,281 INFO [stdout] (http-sb-saildvl-01-172.31.131.129-8080-4) at com.liferay.portal.spring.aop.ChainableMethodAdvice.invoke(ChainableMethodAdvice.java:59)
11:14:21,281 INFO [stdout] (http-sb-saildvl-01-172.31.131.129-8080-4) at com.liferay.portal.spring.aop.ServiceBeanMethodInvocation.proceed(ServiceBeanMethodInvocation.java:108)
11:14:21,281 INFO [stdout] (http-sb-saildvl-01-172.31.131.129-8080-4) at com.liferay.portal.spring.aop.ChainableMethodAdvice.invoke(ChainableMethodAdvice.java:59)
11:14:21,281 INFO [stdout] (http-sb-saildvl-01-172.31.131.129-8080-4) at com.liferay.portal.spring.aop.ServiceBeanMethodInvocation.proceed(ServiceBeanMethodInvocation.java:108)
11:14:21,281 INFO [stdout] (http-sb-saildvl-01-172.31.131.129-8080-4) at com.liferay.portal.spring.aop.ServiceBeanAopProxy.invoke(ServiceBeanAopProxy.java:211)
11:14:21,281 INFO [stdout] (http-sb-saildvl-01-172.31.131.129-8080-4) at com.liferay.portal.service.impl.OrganizationLocalServiceImpl.updateAsset(OrganizationLocalServiceImpl.java:1510)
11:14:21,281 INFO [stdout] (http-sb-saildvl-01-172.31.131.129-8080-4) at com.liferay.portal.service.impl.OrganizationLocalServiceImpl.addOrganization(OrganizationLocalServiceImpl.java:201)
11:14:21,281 INFO [stdout] (http-sb-saildvl-01-172.31.131.129-8080-4) at com.liferay.portal.spring.aop.ServiceBeanMethodInvocation.proceed(ServiceBeanMethodInvocation.java:112)
11:14:21,281 INFO [stdout] (http-sb-saildvl-01-172.31.131.129-8080-4) at com.liferay.portal.spring.transaction.TransactionInterceptor.invoke(TransactionInterceptor.java:71)
11:14:21,282 INFO [stdout] (http-sb-saildvl-01-172.31.131.129-8080-4) at com.liferay.portal.spring.aop.ServiceBeanMethodInvocation.proceed(ServiceBeanMethodInvocation.java:108)
11:14:21,282 INFO [stdout] (http-sb-saildvl-01-172.31.131.129-8080-4) at com.liferay.portal.spring.aop.ChainableMethodAdvice.invoke(ChainableMethodAdvice.java:59)
11:14:21,282 INFO [stdout] (http-sb-saildvl-01-172.31.131.129-8080-4) at com.liferay.portal.spring.aop.ServiceBeanMethodInvocation.proceed(ServiceBeanMethodInvocation.java:108)
11:14:21,282 INFO [stdout] (http-sb-saildvl-01-172.31.131.129-8080-4) at com.liferay.portal.spring.aop.ChainableMethodAdvice.invoke(ChainableMethodAdvice.java:59)
11:14:21,282 INFO [stdout] (http-sb-saildvl-01-172.31.131.129-8080-4)

Investigation:
Using truss/strace I was able to figure out, that one of the last things performed, before the SIGSEGV (java.lang.NullPointerException) exception occurs, was a database SELECT statement:

1115/118: read(43, " 1\0\0\004 2\0\0\004 T\0".., 8192) = 5014
1115/118: send(43, " P\0\00381\0 s e l e c t".., 1137, 0) = 1137
1115/118: read(43, " 1\0\0\004 2\0\0\004 T\0".., 8192) = 372
1115/118: lwp_cond_signal(0x0A410858) = 0
1115/881: lwp_cond_wait(0x0A410858, 0x0A410840, 0x00000000, 0) = 0
1115/881: lwp_cond_signal(0x0A0B4FB0) = 0
1115/876: lwp_cond_wait(0x0A0B4FB0, 0x0A0B4F98, 0x00000000, 0) = 0
1115/118: Incurred fault #6, FLTBOUNDS %pc = 0xFAE1231D
1115/118: siginfo: SIGSEGV SEGV_MAPERR addr=0x00000004
1115/118: Received signal #11, SIGSEGV [caught]
1115/118: siginfo: SIGSEGV SEGV_MAPERR addr=0x00000004
1115/118: lwp_sigmask(SIG_SETMASK, 0xFFBFFEFF, 0x0000FFF7) = 0xFFBFFEFF [0x0000FFFF]
1115/118: setcontext(0xA72820B0)
1115/118: send(43, " B\0\0\010\0 S _ 3 7\0\0".., 32, 0) = 32
1115/118: read(43, " 2\0\0\004 C\0\0\0\r R O".., 8192) = 25

I configured database query logging and was able to track this SELECT statement down to the following:

LOG: execute <unnamed>: select assetvocab0_.vocabularyId as vocabula1_78_, assetvocab0_.uuid_ as uuid2_78_, assetvocab0_.groupId as groupId78_, assetvocab0_.companyId as companyId78_, assetvocab0_.userId as userId78_, assetvocab0_.userName as userName78_, assetvocab0_.createDate as createDate78_, assetvocab0_.modifiedDate as modified8_78_, assetvocab0_.name as name78_, assetvocab0_.title as title78_, assetvocab0_.description as descrip11_78_, assetvocab0_.settings_ as settings12_78_ from AssetVocabulary assetvocab0_ where (assetvocab0_.groupId=$1 ) order by assetvocab0_.name ASC
DETAIL: parameters: $1 = '10191'

After that I backed up my database and deleted all custom vocabularies thru control panel.
After deleting them, the error was not in affect any more.
I restored the database, resulting in the error showing up again.
After that I inspected the AssetVocabulary table and figured out, that all preconfigured vocabularies had an empty text stored in the stettings_ column, but the custom vocabulary had a multiline text in there. In the SQL dump, the content of this column shows:

multiValued=false\nselectedClassNameIds=0\n

Possible Relationships:
The custom vocabulary I've created thru the control panel was in the global scope only
I alread had a complex organization structure set up, before the vocabulary was created.
I only tried to add a single location to this organization structure, not another organization.

Workaround:
In the database I deleted the setting of the custom vocabulary using the following SQL statement:

update assetvocabulary set settings_='' where uuid_='...';

After that adding locations/organization thru the control panel was possible again.

Detailed steps to reproduce this error:
Create a custom vocabulary named 'test' with descripton 'test' in the global scope.
Afterwards try to create a location
-> this results in the described error
In the SQL browser, the newly created vocabulary shows the multilined setting_ column.
Delete this using the SQL statement shown above.
Now try to create a location again.
-> location creation is possible
Now go to the category tab in the control panel.
Edit the custom vocabulary using the action supported in the control panel.
Do not change anything, but simply press the SAVE button.
In the SQL browser, now the newly created vocabulary only shows a single key/value pair in the setting_ column.
Now try to create a location again
-> location creation is possible

Conclusion:
At the time, a vocabulary exists, that has more than one value stored in the settiings_ column, liferay 6.1.0 CE GA1 runs into a NullPointerException when creating a location (or organization?). The problem seems to be triggered, if more than one value is stored in the 'settings_' column. This is done by liferay when creating a new assetvocabulary entry. Editing an existing entry will only introduce one value to the 'settings_' column. This tracks down the issue to the create method of vocabularies.